@thinkingai/ae-cli 6.0.22 → 6.0.27

package/dist/{auth-RDN6D5HU.js → auth-7TQRGLBC.js}

@@ -1,26 +1,25 @@
 import {
   printError,
   printOutput
-} from "./chunk-YACCPUNQ.js";
+} from "./chunk-ZAOL36CG.js";
 import {
   clearCliToken,
   mintCliToken
-} from "./chunk-FPE5LGVU.js";
+} from "./chunk-2NDGFQHW.js";
 import {
   clear,
-  clearToken,
-  getAuthStatus,
   load,
   resolveHost,
   save
-} from "./chunk-U6QPKCN3.js";
+} from "./chunk-AJTH7LT3.js";
 import {
   getFallbackCliToken,
   loadConfig,
   logger,
+  normalizeUrl,
   removeHost,
   saveConfig
-} from "./chunk-WPXHCP4A.js";
+} from "./chunk-YCLVYFK7.js";
 
 // src/core/device-auth.ts
 import { execFileSync } from "child_process";
@@ -234,13 +233,14 @@ function resolveAuthHost(program, opts) {
 }
 function activateHostAfterLogin(host, explicitHostOverride) {
   if (!explicitHostOverride) return;
+  const normalized = normalizeUrl(host);
   const config = loadConfig();
-  if (!config.hosts[host]) {
-    config.hosts[host] = { label: host };
+  if (!config.hosts[normalized]) {
+    config.hosts[normalized] = { label: normalized };
   }
-  config.activeHost = host;
+  config.activeHost = normalized;
   saveConfig(config);
-  logger.info(`Active host set to ${host} after login`);
+  logger.info(`Active host set to ${normalized} after login`);
 }
 async function persistDeviceTokens(host, tokens) {
   const DEFAULT_EXPIRES_IN = 72e3;
@@ -369,15 +369,14 @@ function registerAuth(program) {
           authenticated: true,
           host,
           source: "sandbox-cli-token",
-          hasCliToken: true
+          hasCliToken: true,
+          note: "sandbox-provisioned cli-token.json; no user access token in secure-store"
         },
         program.opts().format || "json"
       );
       return;
     }
-    const tokenStatus = getAuthStatus(host);
-    const authenticated = tokenStatus.authenticated;
-    printOutput({ authenticated, host, source: tokenStatus.source ?? "none" }, program.opts().format || "json");
+    printOutput({ authenticated: false, host, source: "none" }, program.opts().format || "json");
   });
   auth.command("logout").description("Clear stored credentials (access token, CLI token, and host config) for a host (--host or active host)").option("--host <url>", HOST_OPTION_DESC).action((opts) => {
     const host = resolveAuthHost(program, opts);
@@ -386,7 +385,6 @@ function registerAuth(program) {
       process.exit(1);
     }
     clearCliToken(host);
-    clearToken(host);
     clear(host);
     removeHost(host);
     process.stderr.write(`[ae-cli] Credentials and config cleared for ${host}

package/dist/auth-MEJ642P4.js

@@ -0,0 +1,13 @@
+import {
+  getToken,
+  invalidateAccessTokenForRetry,
+  resolveHost,
+  validateToken
+} from "./chunk-AJTH7LT3.js";
+import "./chunk-YCLVYFK7.js";
+export {
+  getToken,
+  invalidateAccessTokenForRetry,
+  resolveHost,
+  validateToken
+};

package/dist/chunk-2NDGFQHW.js

@@ -0,0 +1,190 @@
+import {
+  getToken,
+  load,
+  loadCliToken,
+  save
+} from "./chunk-AJTH7LT3.js";
+import {
+  getActiveHost,
+  getConfigDir,
+  getFallbackCliToken,
+  listHosts,
+  logger,
+  normalizeUrl,
+  safeJsonParse,
+  safeReadJsonFile
+} from "./chunk-YCLVYFK7.js";
+
+// src/core/cli-token.ts
+import fs from "fs";
+import path from "path";
+var CLI_TOKEN_GENERATE_PATH = "/v1/ta/cli/token/generate";
+var _cliTokenCache = /* @__PURE__ */ new Map();
+var _renewedLocalDateByHost = /* @__PURE__ */ new Map();
+var _renewInFlightByHost = /* @__PURE__ */ new Map();
+function renewHostKey(hostUrl) {
+  return normalizeUrl(hostUrl);
+}
+function renewStateFilePath() {
+  return path.join(getConfigDir(), "cli-token-renew.json");
+}
+function localRenewDate(now = /* @__PURE__ */ new Date()) {
+  const y = now.getFullYear();
+  const m = String(now.getMonth() + 1).padStart(2, "0");
+  const d = String(now.getDate()).padStart(2, "0");
+  return `${y}-${m}-${d}`;
+}
+function loadRenewStore() {
+  try {
+    const file = renewStateFilePath();
+    if (!fs.existsSync(file)) return {};
+    const data = safeReadJsonFile(file);
+    if (!data || typeof data !== "object" || Array.isArray(data)) return {};
+    return data;
+  } catch {
+    return {};
+  }
+}
+function saveRenewStore(store) {
+  const dir = getConfigDir();
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+  const file = renewStateFilePath();
+  if (Object.keys(store).length === 0) {
+    try {
+      fs.unlinkSync(file);
+    } catch {
+    }
+    return;
+  }
+  fs.writeFileSync(file, JSON.stringify(store, null, 2), { encoding: "utf8" });
+  try {
+    fs.chmodSync(file, 384);
+  } catch {
+  }
+}
+function clearRenewState(hostUrl) {
+  if (hostUrl) {
+    const key = renewHostKey(hostUrl);
+    _renewedLocalDateByHost.delete(key);
+    _renewInFlightByHost.delete(key);
+    if (key !== hostUrl) {
+      _renewedLocalDateByHost.delete(hostUrl);
+      _renewInFlightByHost.delete(hostUrl);
+    }
+    const store = loadRenewStore();
+    let changed = false;
+    for (const k of /* @__PURE__ */ new Set([key, hostUrl])) {
+      if (store[k]) {
+        delete store[k];
+        changed = true;
+      }
+    }
+    if (changed) {
+      saveRenewStore(store);
+    }
+    return;
+  }
+  _renewedLocalDateByHost.clear();
+  _renewInFlightByHost.clear();
+  saveRenewStore({});
+}
+async function generateCliToken(hostUrl) {
+  const accessToken = await getToken(hostUrl);
+  const base = hostUrl.replace(/\/+$/, "");
+  const url = `${base}${CLI_TOKEN_GENERATE_PATH}`;
+  const resp = await fetch(url, {
+    method: "GET",
+    headers: {
+      "Authorization": `bearer ${accessToken}`
+    }
+  });
+  if (!resp.ok) {
+    throw new Error(`CLI token generate HTTP error: ${resp.status} ${resp.statusText}`);
+  }
+  const data = safeJsonParse(await resp.text());
+  if (data.return_code !== 0) {
+    throw new Error(`CLI token generate error: ${data.return_message || "unknown"} (code: ${data.return_code})`);
+  }
+  const cliToken = data.data?.userSecret;
+  if (!cliToken) {
+    throw new Error("CLI token generate error: empty userSecret in response");
+  }
+  return cliToken;
+}
+function persistCliTokenIfPossible(hostUrl, cliToken) {
+  const existing = load(hostUrl);
+  if (!existing) {
+    logger.info(`cli-token: no secure-store session for ${hostUrl}, keeping token in-process only`);
+    return;
+  }
+  save(hostUrl, { ...existing, cliToken });
+}
+function clearPersistedCliToken(hostUrl) {
+  const existing = load(hostUrl);
+  if (existing?.cliToken) {
+    save(hostUrl, { ...existing, cliToken: void 0 });
+  }
+}
+async function getCliToken(hostOverride) {
+  const hostUrl = hostOverride || getActiveHost();
+  let token = _cliTokenCache.get(hostUrl);
+  if (!token) {
+    const storedToken = loadCliToken(hostUrl);
+    if (storedToken) {
+      _cliTokenCache.set(hostUrl, storedToken);
+      logger.info(`Using persisted CLI token (secure-store) for ${hostUrl}`);
+      token = storedToken;
+    }
+  }
+  if (!token) {
+    const fallbackToken = getFallbackCliToken(hostUrl);
+    if (fallbackToken) {
+      _cliTokenCache.set(hostUrl, fallbackToken);
+      logger.info(`Using sandbox-provisioned CLI token (fallback file) for ${hostUrl}`);
+      token = fallbackToken;
+    }
+  }
+  if (!token) {
+    token = await mintCliToken(hostUrl);
+  }
+  return token;
+}
+async function mintCliToken(hostUrl) {
+  logger.info(`Generating CLI token for ${hostUrl}`);
+  const cliToken = await generateCliToken(hostUrl);
+  _cliTokenCache.set(hostUrl, cliToken);
+  persistCliTokenIfPossible(hostUrl, cliToken);
+  logger.info(`CLI token generated, cached, and persisted for ${hostUrl}`);
+  return cliToken;
+}
+function clearCliToken(hostUrl) {
+  if (hostUrl) {
+    _cliTokenCache.delete(hostUrl);
+    clearPersistedCliToken(hostUrl);
+    clearRenewState(hostUrl);
+    return;
+  }
+  _cliTokenCache.clear();
+  clearRenewState();
+  for (const { url } of listHosts()) {
+    clearPersistedCliToken(url);
+  }
+}
+function setCliTokenManual(token, hostUrl) {
+  _cliTokenCache.set(hostUrl, token);
+  persistCliTokenIfPossible(hostUrl, token);
+  logger.info(`CLI token set for ${hostUrl}`);
+}
+function _resetRenewMemoryForTest() {
+  _renewedLocalDateByHost.clear();
+  _renewInFlightByHost.clear();
+}
+
+export {
+  localRenewDate,
+  getCliToken,
+  mintCliToken,
+  clearCliToken,
+  setCliTokenManual,
+  _resetRenewMemoryForTest
+};

package/dist/{chunk-5FBLRSMU.js → chunk-7QQ4233A.js}

@@ -1,18 +1,18 @@
 import {
   getAnalysisMappingPathForClusterMode
-} from "./chunk-XE2PI5DS.js";
+} from "./chunk-KGJQCYVC.js";
 import {
   PermissionError
 } from "./chunk-NOO24N7W.js";
 import {
   clearCliToken,
   getCliToken
-} from "./chunk-FPE5LGVU.js";
+} from "./chunk-2NDGFQHW.js";
 import {
   getActiveHost,
   logger,
   safeJsonParse
-} from "./chunk-WPXHCP4A.js";
+} from "./chunk-YCLVYFK7.js";
 
 // src/core/mcp.ts
 async function permissionMessage(resp) {

package/dist/{chunk-U6QPKCN3.js → chunk-AJTH7LT3.js}

@@ -2,13 +2,9 @@ import {
   getActiveHost,
   getConfigDir,
   logger,
-  safeJsonParse,
-  safeReadJsonFile
-} from "./chunk-WPXHCP4A.js";
-
-// src/core/auth.ts
-import fs2 from "fs";
-import path2 from "path";
+  normalizeUrl,
+  safeJsonParse
+} from "./chunk-YCLVYFK7.js";
 
 // src/core/secure-store.ts
 import crypto from "crypto";
@@ -236,24 +232,8 @@ var SecureStoreAuthError = class extends Error {
 };
 
 // src/core/auth.ts
-var TOKENS_FILE = path2.join(getConfigDir(), "tokens.json");
-var LEGACY_MCP_TOKENS_FILE = path2.join(getConfigDir(), "mcp-tokens.json");
-var LEGACY_DIR = path2.join(process.env.HOME || "", ".te-mcp");
-(function removeLegacyMcpTokens() {
-  try {
-    if (fs2.existsSync(LEGACY_MCP_TOKENS_FILE)) {
-      fs2.rmSync(LEGACY_MCP_TOKENS_FILE);
-      logger.info("auth: removed legacy mcp-tokens.json (plaintext MCP token file)");
-    }
-  } catch {
-  }
-})();
-function ensureDir() {
-  const dir = getConfigDir();
-  if (!fs2.existsSync(dir)) fs2.mkdirSync(dir, { recursive: true });
-}
 function resolveHost(hostOverride) {
-  if (hostOverride) return hostOverride;
+  if (hostOverride) return normalizeUrl(hostOverride);
   return getActiveHost();
 }
 async function validateToken(token, hostUrl) {
@@ -270,89 +250,11 @@ async function validateToken(token, hostUrl) {
     return false;
   }
 }
-function loadAllTokens() {
-  try {
-    const legacyTokens = path2.join(LEGACY_DIR, "tokens.json");
-    if (fs2.existsSync(legacyTokens) && !fs2.existsSync(TOKENS_FILE)) {
-      const data = safeReadJsonFile(legacyTokens);
-      const migrated = {};
-      for (const [key, val] of Object.entries(data)) {
-        const url = key.startsWith("http") ? key : `https://${key}`;
-        migrated[url] = val;
-      }
-      ensureDir();
-      fs2.writeFileSync(TOKENS_FILE, JSON.stringify(migrated, null, 2));
-      return migrated;
-    }
-    if (fs2.existsSync(TOKENS_FILE)) {
-      const data = safeReadJsonFile(TOKENS_FILE);
-      if (data && typeof data === "object" && !Array.isArray(data) && Object.keys(data).length === 0) {
-        try {
-          fs2.unlinkSync(TOKENS_FILE);
-        } catch {
-        }
-        return {};
-      }
-      let needsMigration = false;
-      const migrated = {};
-      for (const [key, val] of Object.entries(data)) {
-        if (!key.startsWith("http")) {
-          migrated[`https://${key}`] = val;
-          needsMigration = true;
-        } else {
-          migrated[key] = val;
-        }
-      }
-      if (needsMigration) {
-        fs2.writeFileSync(TOKENS_FILE, JSON.stringify(migrated, null, 2));
-        return migrated;
-      }
-      return data;
-    }
-  } catch {
-  }
-  return {};
-}
-function saveAllTokens(tokens) {
-  ensureDir();
-  if (Object.keys(tokens).length === 0) {
-    try {
-      fs2.unlinkSync(TOKENS_FILE);
-    } catch {
-    }
-    return;
-  }
-  fs2.writeFileSync(TOKENS_FILE, JSON.stringify(tokens, null, 2));
-  try {
-    fs2.chmodSync(TOKENS_FILE, 384);
-  } catch {
-  }
-}
-function loadToken(hostUrl) {
-  const tokens = loadAllTokens();
-  const entry = tokens[hostUrl];
-  if (!entry || !entry.token) return null;
-  return { host: hostUrl, token: entry.token, updatedAt: entry.updatedAt };
-}
-function saveToken(token, hostUrl) {
-  const tokens = loadAllTokens();
-  tokens[hostUrl] = { token, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
-  saveAllTokens(tokens);
-  logger.info(`Token saved for ${hostUrl}`);
-}
-function clearToken(hostUrl) {
-  const tokens = loadAllTokens();
-  delete tokens[hostUrl];
-  saveAllTokens(tokens);
-}
-function getAuthStatus(hostUrl) {
-  const cached = loadToken(hostUrl);
-  if (cached) {
-    const ageMs = Date.now() - new Date(cached.updatedAt).getTime();
-    const hours = Math.round(ageMs / 36e5);
-    return { authenticated: true, host: hostUrl, tokenAge: `${hours}h ago`, source: "cache" };
-  }
-  return { authenticated: false, host: hostUrl };
+function invalidateAccessTokenForRetry(hostUrl) {
+  const payload = load(hostUrl);
+  if (!payload) return;
+  save(hostUrl, { ...payload, accessExpiresAt: (/* @__PURE__ */ new Date(0)).toISOString() });
+  logger.info(`auth: marked access token stale for retry on ${hostUrl}`);
 }
 async function getToken(hostUrl) {
   if (!hostUrl) {
@@ -361,11 +263,6 @@ async function getToken(hostUrl) {
 Run: ae-cli config set-host <url>`
     );
   }
-  const cached = loadToken(hostUrl);
-  if (cached && cached.token) {
-    logger.info(`Using cached token for ${hostUrl}`);
-    return cached.token;
-  }
   try {
     const secureToken = await getValidAccessToken(hostUrl);
     logger.info(`Using secure-store token for ${hostUrl}`);
@@ -391,9 +288,6 @@ export {
   SecureStoreAuthError,
   resolveHost,
   validateToken,
-  loadToken,
-  saveToken,
-  clearToken,
-  getAuthStatus,
+  invalidateAccessTokenForRetry,
   getToken
 };